Real-World Cases

Computer Forensics and Electronic Discovery

E-discovery is a term that is sometimes used interchangeably with the terms computer forensics or digital forensics, however, to use them interchangeably is inaccurate. E-discovery, short for electronic discovery, is the term used to refer to any type of electronic evidence produced during the course of civil litigation. In essence, the difference between e-discovery and computer forensics is q question of semantics, and in its most fundamental sense, the distinguishing characteristic is volume. Typically, large e-discovery projects involve the re-construction of massive quantities of documents, e-mails, and other information from systems, servers, and backup media to large databases and searchable formats. These items are then reviewed by legal document review experts that will decide whether or not the information is relevant to the case. Software developers continue to produce programs that are capable of organizing and managing these massive discovery projects to make review more efficient and simple. These programs can cost thousands of dollars to purchase.

The term is used particularly in this manner because it is more a legal term of art than a scientific term. Further, there is a plethora of case law surrounding large-scale and typically expensive litigation costs to produce e-discovery projects. Forensic examiners assist in the process of e-discovery by determining locations where evidence relative to the civil litigation may exist, copying it, and producing it to litigators in some type of understandable form. Often times there is contentious debate about the scope of what a party in litigation is or is not entitled to from the other party. Rule 26 and 34 of the Federal Rules of Civil Procedure now deal with electronically stored information. Private computer forensic practitioners, boutique firms, and the big five forensic consulting agencies all deal extensively with e-discovery in civil litigation.